fyannk/pgadmin repository overview

⁠pgAdmin for OpenShift

OpenShift-friendly pgAdmin 4⁠ container images with two variants:

• An upstream-compatible image with privileged-port capability support removed.
• A hardened, source-built image with refreshed dependencies and a reduced runtime footprint.

Source code, Dockerfiles, and build automation are available on GitHub⁠.

⁠Available tags

For predictable deployments, pin a versioned tag instead of using latest.

⁠Quick start

docker run --rm \
  -p 8080:8080 \
  -e [email protected] \
  -e PGADMIN_DEFAULT_PASSWORD='change-me' \
  fyannk/pgadmin:latest

Open http://localhost:8080⁠ and sign in using the configured credentials.

For production deployments, prefer PGADMIN_DEFAULT_PASSWORD_FILE with a mounted secret instead of putting the password directly in an environment variable.

⁠OpenShift example

apiVersion: apps/v1
kind: Deployment
metadata:
  name: pgadmin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pgadmin
  template:
    metadata:
      labels:
        app: pgadmin
    spec:
      containers:
        - name: pgadmin
          image: docker.io/fyannk/pgadmin:latest
          ports:
            - name: http
              containerPort: 8080
          env:
            - name: PGADMIN_DEFAULT_EMAIL
              value: [email protected]
            - name: PGADMIN_DEFAULT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: pgadmin-credentials
                  key: password
          volumeMounts:
            - name: data
              mountPath: /var/lib/pgadmin
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: pgadmin

The images use an unprivileged port and are designed for restricted OpenShift environments. External access should be provided through a Service and Route.

⁠Image variants

⁠Upstream-compatible

The <version> tags stay close to the official pgAdmin image:

• Based on dpage/pgadmin4:<version>.
• Retain upstream packages, dependencies, and behavior.
• Remove the dedicated capability-bearing Python binary.
• Default to unprivileged ports 8080 and 8443.
• Published once for each pgAdmin release.

Choose this variant when compatibility with the official image is the priority.

⁠Hardened

The <version>-hardened and latest tags are rebuilt from the matching upstream pgAdmin source release:

• Run as non-root UID 5050 by default.
• Support OpenShift arbitrary UIDs through GID 0.
• Include PostgreSQL 14–18 client utilities.
• Refresh Alpine and Python dependencies during rebuilds.
• Exclude build tools from the final runtime image.
• Do not include Postfix, sudo, libcap, or capability-bearing Python binaries.
• Disable the in-container password-reset email service.
• Publish SBOM and build-provenance attestations.

Choose this variant when a smaller privilege footprint and regularly refreshed dependencies are preferred.

⁠Ports

Set PGADMIN_LISTEN_PORT to use another unprivileged port.

The images intentionally do not include the capability required to bind directly to ports below 1024. Use container port mapping, a Kubernetes Service, or an OpenShift Route for ports 80 and 443.

⁠Persistent storage

Mount persistent storage at:

/var/lib/pgadmin

Make sure the volume is writable by the container UID or by GID 0 when using OpenShift arbitrary UIDs.

⁠Required configuration

A new installation normally requires:

PGADMIN_DEFAULT_EMAIL
PGADMIN_DEFAULT_PASSWORD

Where supported, use:

PGADMIN_DEFAULT_PASSWORD_FILE

See the official pgAdmin container documentation⁠ for additional runtime configuration.

⁠Security notes

These images remove privileged-port support, but no container image can guarantee a permanent zero-vulnerability result.

The hardened variant is rebuilt regularly to consume available Alpine and Python security updates. Findings without an available vendor fix should be assessed according to your organisation's vulnerability-management policy.

Always scan the exact image digest you intend to deploy.

⁠Links

• GitHub repository⁠
• Build and publishing workflow⁠
• pgAdmin project⁠
• Upstream pgAdmin source⁠
• Official pgAdmin container documentation⁠